Live data from Hacker News

High-performance .NET by example: Filtering bot traffic

alexandrnikitin.github.io

21–30 of 54 posts

Re: High-performance .NET by example: Filtering bot traffic

#21
post #12

Earlier quoted context omitted.

I doubt that exactly that will work. There are tens of thousands of different UAs (maybe 100K). Perhaps some kind of tiny (few CPU cache lines) cache for most popular UAs could help. But again: measure, measure, measure :)

Publish your test set and I can look at it :)

I'm afraid I can't do that because of proprietary data. I think I can come up with analogous tests using open data. I'll let you know ;)

Re: High-performance .NET by example: Filtering bot traffic

#24

Earlier quoted context omitted.

I have that feeling too. But I found it harder to implement, especially with fallback failure references.

I'd look for a library and not write one from scratch. Lucene [1] and OpenFST [2] are great implementations. I haven't used C#, so I don't know if bindings exist or not. Also you may find this talk useful [3] (Particularly slide 11). Great write up by the way. Really thorough on the benchmarking! [1] https://lucene.apache.org/core/4_1_0/core/org/apache/lucene/... [2] http://www.openfst.org/twiki/bin/view/FST/WebHome…

Awesome! The talk is great! It would be really interesting to try it. Thanks for sharing.

Re: High-performance .NET by example: Filtering bot traffic

#25
post #13

Excellent post showing how to correctly improve code w.r.t. performance using the scientific method: hypothesis, measuring the baseline, change, measuring effect with real tools, real code. Thanks for sharing!

I also found it an interesting post in that it kind of inadvertently proves that for most situations you shouldn't optimise to this extent. Meaning, yes, the OP got impressive performance improvements but the code is also completely unreadable and utilises unsafe code sections which could expose you to security problems/memory leaks/memory corruption. Not to mention they've recreated and will need to maintain an in-h…

No, no no no.

I cannot believe that you are honestly saying a 2x increase to throughput in production is something you "shouldn't take seriously" because the code isn't as readable as it was before.

Programmers are expensive. Hardware is cheap. That doesn't justify completely throwing out the window any performance increasing changes just because a fresh college grad won't be able to understand what's going on within 10 minutes.

Re: High-performance .NET by example: Filtering bot traffic

#26
post #22

Good post! A lot of manual work with various perf tools. What's a bit missing is some production performance monitoring (APM) that gives you such data, with no manual interaction.

I intend to write a separate blog post about low-overhead production monitoring (not sure when it happen though)

Re: High-performance .NET by example: Filtering bot traffic

#27

Blocking access based on arbitrary user agent strings is a really bad idea. Every single bad bot will avoid known user agent strings or pretend to be Google, so you're only blocking well behaved ones. Plus there's thousands of browser versions out there, so there's a very good chance you're blocking some users for no reason. The proper way to do this is to block by IP, based on behavior. Block IPs slowing down the si…

In theory you are right, but in reality 99% of the rogue bots are actually just some scraper tools were ignorant users changed sane defaults to "make it go faster". They usually don't have enough knowledge to even understand that they are routed into a black hole - not to speak of being able to do something about it.

Disclaimer: Getting rid of those idiots^wmisguides poor souls is part of my job description.

Re: High-performance .NET by example: Filtering bot traffic

#28
post #13

Excellent post showing how to correctly improve code w.r.t. performance using the scientific method: hypothesis, measuring the baseline, change, measuring effect with real tools, real code. Thanks for sharing!

I also found it an interesting post in that it kind of inadvertently proves that for most situations you shouldn't optimise to this extent. Meaning, yes, the OP got impressive performance improvements but the code is also completely unreadable and utilises unsafe code sections which could expose you to security problems/memory leaks/memory corruption. Not to mention they've recreated and will need to maintain an in-h…

I agree with you, usually you shouldn't optimize to the point when code quality starts suffer. It's all about trade offs. If you have one or two hundred servers and millions of RPS then it could be reasonable. Or coming back to the code quality, perhaps it's worth to re-visit the efficiency part and find another algorithm/ approach (someone suggested FSM in comments in this case)

Re: High-performance .NET by example: Filtering bot traffic

#29

what if the "grey" traffic came from residential IP addresses using a normally distributed range of user agents? How would you reliable distinguish them from regular traffic?

Basically, we are using two sort of technics : technical and behavior.

Technical : if the UserAgent claim to be a regular browser (let say Chrome 43) we will check on network level if the client implement http protocol like Chrome 43 usually do and on the JS side if the Javascript render is correct for Chrome. In case it's a real Chrome, we will check if the Browser is controlled by automation Tool.

Behavior : we will check if the path of requests is regular according to the website usage.

Disclaimer: I'm working at https://datadome.co, a bot protection tool.

Re: High-performance .NET by example: Filtering bot traffic

#30

what if the "grey" traffic came from residential IP addresses using a normally distributed range of user agents? How would you reliable distinguish them from regular traffic?

It depends. Usually do nothing if that traffic is very low. There's no reliable way to do that. Honeypots and behavior analysis are very useful here.
Post reply on HN